CWE-863 · Incorrect Authorization (page 14)
Page 14 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54569 | Medium | 4.5 | 2025-07-28 | In Malwarebytes Binisoft Windows Firewall Control before 6.16.0.0, the installer is vulnerable to local privilege escalation. |
CVE-2025-54596 | Medium | 4.3 | 2025-07-25 | Abnormal Security /v1.0/rbac/users_v2/{USER_ID}/ before 2025-02-19 allows downgrading the privileges of other user accounts. |
CVE-2025-0765 | Medium | 4.3 | 2025-07-24 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed… |
CVE-2025-6018 | High | 7.8 | 2025-07-23 | A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unp… |
CVE-2025-29757 | | 2025-07-19 | An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer… | |
CVE-2025-53943 | | 2025-07-16 | VoidBot Open-Source is a customizable Discord bot. VoidBot Open-Source versions 0.0.1 through 0.8.1 contain a vulnerability in the command handler where permis… | |
CVE-2025-6981 | Medium | 4.3 | 2025-07-15 | An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors… |
CVE-2025-50086 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.42, 8.4… |
CVE-2025-50085 | Medium | 5.5 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9… |
CVE-2025-50084 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 a… |
CVE-2025-30751 | High | 8.8 | 2025-07-15 | Vulnerability in the Oracle Database component of Oracle Database Server. Supported versions that are affected are 19.27 and 23.4-23.8. Easily exploitable v… |
CVE-2025-30750 | Low | 2.4 | 2025-07-15 | Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 19.3-19.27, 21.3-21.18 and 23.4-23.8. Easily… |
CVE-2025-30748 | Medium | 6.1 | 2025-07-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are… |
CVE-2025-30747 | Medium | 4.3 | 2025-07-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are… |
CVE-2025-30744 | High | 8.1 | 2025-07-15 | Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Multiplatform Sync Errors). Supported versions that are affect… |
CVE-2025-30743 | High | 8.1 | 2025-07-15 | Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal Operations). The supported version that is a… |
CVE-2025-30739 | Medium | 5.5 | 2025-07-15 | Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12… |
CVE-2025-53895 | High | 8.8 | 2025-07-15 | ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability i… |
CVE-2025-53836 | Critical | 9.9 | 2025-07-15 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting… |
CVE-2025-5199 | High | 7.3 | 2025-07-12 | In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying fi… |
CVE-2025-6549 | Medium | 6.5 | 2025-07-11 | An Incorrect Authorization vulnerability in the web server of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to reac… |
CVE-2025-6168 | Low | 2.7 | 2025-07-10 | An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintaine… |
CVE-2025-4972 | Low | 2.7 | 2025-07-10 | An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated users wit… |
CVE-2025-3396 | Medium | 4.3 | 2025-07-10 | An issue has been discovered in GitLab EE affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed a… |
CVE-2025-49536 | High | 7.3 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypas… |
CVE-2025-21450 | Critical | 9.1 | 2025-07-08 | Cryptographic issue occurs due to use of insecure connection method while downloading. |
CVE-2025-20999 | Medium | 4.1 | 2025-07-08 | Improper authorization in accessing saved Wi-Fi password for Galaxy Tablet prior to SMR Jul-2025 Release 1 allows secondary users to access owner's saved Wi-Fi… |
CVE-2025-20300 | Medium | 4.3 | 2025-07-07 | In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low… |
CVE-2025-26850 | Critical | 9.3 | 2025-07-05 | The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems. |
CVE-2025-0885 | | 2025-07-03 | Incorrect Authorization vulnerability in OpenText™ GroupWise allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could… | |
CVE-2025-32462 | Low | 2.8 | 2025-06-30 | Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on… |
CVE-2025-47871 | Medium | 4.3 | 2025-06-30 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when… |
CVE-2025-46702 | Medium | 5.4 | 2025-06-30 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member managemen… |
CVE-2025-53391 | Critical | 9.3 | 2025-06-28 | The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit allow_any/allow_inactive/allow_active sett… |
CVE-2025-6702 | Medium | 4.3 | 2025-06-26 | A vulnerability, which was classified as problematic, was found in linlinjava litemall 1.8.0. Affected is an unknown function of the file /wx/comment/post. The… |
CVE-2025-6707 | Medium | 4.2 | 2025-06-26 | Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This… |
CVE-2025-5822 | High | 8.8 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers t… |
CVE-2025-49550 | Medium | 4.3 | 2025-06-25 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result… |
CVE-2025-49549 | Low | 2.7 | 2025-06-25 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result… |
CVE-2025-52890 | High | 8.1 | 2025-06-25 | Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables ru… |
CVE-2025-48466 | High | 8.1 | 2025-06-24 | Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digital Outputs, potentia… |
CVE-2024-3511 | Medium | 4.3 | 2025-06-23 | An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to fla… |
CVE-2025-52918 | Medium | 5.0 | 2025-06-21 | Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces. |
CVE-2025-52487 | High | 7.5 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 7.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-3228 | Medium | 4.3 | 2025-06-20 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from play… |
CVE-2025-3227 | Medium | 4.3 | 2025-06-20 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member managemen… |
CVE-2025-5071 | High | 8.8 | 2025-06-19 | The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs… |
CVE-2025-49825 | Critical | 9.8 | 2025-06-17 | Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulner… |
CVE-2025-3880 | Medium | 4.3 | 2025-06-17 | The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability… |
CVE-2025-49586 | High | 8.8 | 2025-06-13 | XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki)… |
CVE-2025-6003 | Medium | 5.3 | 2025-06-12 | The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versi… |
CVE-2025-48446 | High | 8.8 | 2025-06-11 | Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0… |
CVE-2025-48445 | High | 8.8 | 2025-06-11 | Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from… |
CVE-2025-4128 | Low | 3.1 | 2025-06-11 | Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions an… |
CVE-2024-8270 | Medium | 5.5 | 2025-06-11 | The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Control (TCC) policies, enabling the exploit… |
CVE-2024-7457 | High | 7.8 | 2025-06-11 | The ws.stash.app.mac.daemon.helper tool contains a vulnerability caused by an incorrect use of macOS’s authorization model. Instead of validating the client's… |
CVE-2025-36578 | Medium | 6.8 | 2025-06-10 | Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Incorrect Authorization vulnerability. A low privileged attacker with remote access could pot… |
CVE-2025-40568 | Medium | 4.3 | 2025-06-10 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SC… |
CVE-2025-40567 | Medium | 6.5 | 2025-06-10 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SC… |
CVE-2025-40670 | High | 8.8 | 2025-06-09 | Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by… |
CVE-2025-40669 | Medium | 6.5 | 2025-06-09 | Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the appl… |
CVE-2025-40668 | Medium | 6.5 | 2025-06-09 | Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other user… |
CVE-2025-49599 | Medium | 4.1 | 2025-06-06 | Huawei EG8141A5 devices through V5R019C00S100, EG8145V5 devices through V5R019C00S100, and EG8145V5-V2 devices through V5R021C00S184 allow the Epuser account t… |
CVE-2025-48935 | Critical | 9.1 | 2025-06-04 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission re… |
CVE-2025-48888 | Medium | 5.3 | 2025-06-04 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read -… |
CVE-2025-21479 | High | 8.6 | 2025-06-03 | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. |
CVE-2025-21480 | High | 8.6 | 2025-06-03 | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. |
CVE-2025-3260 | High | 8.3 | 2025-06-02 | A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerabilit… |
CVE-2025-20674 | Critical | 9.8 | 2025-06-02 | In wlan AP driver, there is a possible way to inject arbitrary packet due to a missing permission check. This could lead to remote escalation of privilege with… |
CVE-2025-48948 | Medium | 6.5 | 2025-05-30 | Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated… |
CVE-2025-3611 | Low | 3.1 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allow… |
CVE-2025-1792 | Low | 3.1 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member inf… |
CVE-2024-7097 | Medium | 4.3 | 2025-05-30 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardles… |
CVE-2024-7096 | Medium | 4.2 | 2025-05-30 | A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new u… |
CVE-2025-48881 | High | 8.3 | 2025-05-30 | Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all ob… |
CVE-2025-48757 | Critical | 9.3 | 2025-05-30 | An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database… |
CVE-2025-48475 | High | 8.1 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the System does not provide a check on which "clients" of the System an… |
CVE-2025-48474 | High | 8.1 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application incorrectly checks user access rights for conversations… |
CVE-2025-48473 | Medium | 4.3 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, when creating a conversation from a message in another conversation, th… |
CVE-2025-48472 | High | 8.1 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, there is no check to ensure that the user is disabling notifications fo… |
CVE-2025-3913 | Medium | 5.3 | 2025-05-29 | Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate permissions when changing team privacy se… |
CVE-2025-25251 | High | 7.8 | 2025-05-28 | An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 may allow a local attacker… |
CVE-2025-25026 | Medium | 4.3 | 2025-05-28 | IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check. |
CVE-2025-4975 | | 2025-05-22 | When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power s… | |
CVE-2025-48373 | Critical | 9.1 | 2025-05-22 | Schule is open-source school management system software. The application relies on client-side JavaScript (index.js) to redirect users to different panels base… |
CVE-2024-6914 | Critical | 9.8 | 2025-05-22 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A ma… |
CVE-2024-13947 | Medium | 6.0 | 2025-05-22 | Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromisedThis issue affects ASPECT-Enter… |
CVE-2025-30171 | Critical | 9.0 | 2025-05-22 | System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised. This is… |
CVE-2025-1110 | Low | 2.7 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could ac… |
CVE-2025-20257 | Medium | 6.5 | 2025-05-21 | A vulnerability in an API subsystem of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager could allow an authenticated… |
CVE-2025-1418 | | 2025-05-21 | A low-privileged user can access information about profiles created in Proget MDM (Mobile Device Management), which contain details about allowed/prohibited fu… | |
CVE-2025-1417 | | 2025-05-21 | In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM (Mobile Device Management). Th… | |
CVE-2025-1416 | | 2025-05-21 | In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM (Mobile Device Manag… | |
CVE-2025-1415 | | 2025-05-21 | A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM (Mobile Device Management), as well as details of… | |
CVE-2025-47937 | Low | 3.7 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4… |
CVE-2025-4101 | Medium | 4.3 | 2025-05-17 | The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capabil… |
CVE-2025-47930 | Medium | 5.3 | 2025-05-16 | Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanis… |
CVE-2025-46834 | | 2025-05-15 | Alchemy's Modular Account is a smart contract account that is compatible with ERC-4337 and ERC-6900. In versions on the 2.x branch prior to commit 5e6f540d249a… | |
CVE-2025-2570 | Low | 2.7 | 2025-05-15 | Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which… |
CVE-2025-2527 | Medium | 4.3 | 2025-05-15 | Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view… |